The npm package @chatunity/baileys versions 3.2.0 and 3.2.1 include a runtime dependency on libsignal from an off-registry GitHub repository without commit SHA or tag pinning. This creates a risk of arbitrary code execution during npm install if the repository content changes or if the repository owner account is compromised, due to the mutable and integrity-unchecked dependency.